| Summary: | Subscription manager doesn't link entitlements certs | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | A.P. Rajshekhar <randalap> |
| Component: | subscription-manager | Assignee: | candlepin-bugs |
| Status: | CLOSED DUPLICATE | QA Contact: | John Sefler <jsefler> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | cbredesen, randalap, redakkan, sfloess, vrjain |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-04-21 20:38:27 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
A.P. Rajshekhar
2016-04-20 12:58:11 UTC
There are two things to be aware of before you will see subscription-manager copy attached entitlement certs to the /etc/docker/certs.d/<registery_hostnames> directories.... 1. Are the registry_hostnames that you are concerned about (redhat.com and redhat.io) included in the container_content.ContainerContentPlugin.conf configuration file? [root@jsefler-7 ~]# cat /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf [main] enabled = 1 registry_hostnames = registry.access.redhat.com,cdn.redhat.com,access.redhat.com Note: The default configuration for registry_hostnames does NOT include redhat.com and redhat.io 2. Only entitlement certs that provides "containerimage" content will get copied to the /etc/docker/certs.d/<registery_hostnames> directories. For example... I have the following two entitlements attached to my system.... [root@jsefler-7 ~]# ls /etc/pki/entitlement/ 2867554618564241832-key.pem 2867554618564241832.pem 8620967711851798975-key.pem 8620967711851798975.pem But only one of them (2867554618564241832) has "containerimage" content as follows... [root@jsefler-7 ~]# rct cat-cert /etc/pki/entitlement/2867554618564241832.pem | grep containerimage Type: containerimage Type: containerimage Type: containerimage Type: containerimage Type: containerimage Type: containerimage [root@jsefler-7 ~]# rct cat-cert /etc/pki/entitlement/8620967711851798975.pem | grep containerimage [root@jsefler-7 ~]# Hence only the entitlement and key with "containerimage" content is copied to all of the <registery_hostnames> directories... [root@jsefler-7 ~]# ls /etc/docker/certs.d/registry.access.redhat.com 2867554618564241832.cert 2867554618564241832.key [root@jsefler-7 ~]# ls /etc/docker/certs.d/cdn.redhat.com/ 2867554618564241832.cert 2867554618564241832.key redhat-entitlement-authority.crt [root@jsefler-7 ~]# ls /etc/docker/certs.d/access.redhat.com 2867554618564241832.cert 2867554618564241832.key [root@jsefler-7 ~]# [root@jsefler-7 ~]# ls /etc/docker/certs.d/redhat.io/ redhat-ca.crt [root@jsefler-7 ~]# ls /etc/docker/certs.d/redhat.com/ redhat-ca.crt [root@jsefler-7 ~]# In conclusion, I believe subscription-manager is working as designed and you need to decide if want to add a configuration workflow that appends redhat.com and redhat.io registry_hostnames in /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf. Or do the defaults need to change in container_content.ContainerContentPlugin.conf? John thank you, this is really helpful. In the case where we DO want the keys linked as you described, what would be the change process to make this true for all RHEL clients? Currently the RHMAP team is providing manual steps to link the certs but your way sounds more sustainable and more correct. The mission here is to have a RHEL user acquire protected Red Hat content from our registry (registry.access.redhat.com / registry.redhat.io). A properly-entitled system can access, for example, Red Hat Mobile Application Platform (RHMAP). Container-wise, the rules should be the same. If they have an entitlement to this content, they should be able to use it from Docker as well. Does that help clarify? Be careful... In comment 0 I see that docker is now providing these two directories: /etc/docker/certs.d/redhat.io/ /etc/docker/certs.d/redhat.com/ If the new registries are registry.access.redhat.com and registry.redhat.io as Chris states in comment 5, then I think the directory names will need to be fully qualified and appended to the registery_hostnames in /etc/rhsm/pluginconf.d/container_content.ContainerContentPlugin.conf as a fully qualified names. Also make sure the proper CA cert is in the directories. *** This bug has been marked as a duplicate of bug 1328729 *** Commenting to resolve needifo. |